pandastealer | 9d8e8fe97d70415787127052d57f80f922230d8f45efc168a5125304ef875d66

General

Target

df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe
Size

5.0MB
MD5

df8d2bf603a5597433e8cfd62dbe7593
SHA1

9ba9af56b79830af9d099800762ac9ae69fdb7d8
SHA256

9d8e8fe97d70415787127052d57f80f922230d8f45efc168a5125304ef875d66
SHA512

5c1c612dc3449c1f177d91f7de0e8963a4d31e5d35ef567f205cfbd8b52c293304093b6657672787a2156bee75cee3608d016e781a4a11383961f85e2c571d1a
SSDEEP

98304:fBioZ7jsAmDYzf8frxWjs6rWvPBC774rHKzqesTkdGn640UinsdIwFv:fBNjsjDSf84I60C776HKzCj6qisdbv

Score

10^/10

pandastealer shurk credential_access discovery infostealer spyware stealer

Malware Config

Signatures

Panda Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2332-11-0x0000000000400000-0x0000000000C5F000-memory.dmp	family_pandastealer
behavioral1/memory/2332-15-0x0000000000400000-0x0000000000C5F000-memory.dmp	family_pandastealer
behavioral1/memory/2332-18-0x0000000000400000-0x0000000000C5F000-memory.dmp	family_pandastealer
behavioral1/memory/2332-19-0x0000000000400000-0x0000000000C5F000-memory.dmp	family_pandastealer
behavioral1/memory/2332-34-0x0000000000400000-0x0000000000C5F000-memory.dmp	family_pandastealer

PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
stealer pandastealer
Shurk
Shurk is an infostealer, written in C++ which appeared in 2021.
infostealer shurk

Shurk Stealer payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2332-11-0x0000000000400000-0x0000000000C5F000-memory.dmp	shurk_stealer
behavioral1/memory/2332-15-0x0000000000400000-0x0000000000C5F000-memory.dmp	shurk_stealer
behavioral1/memory/2332-18-0x0000000000400000-0x0000000000C5F000-memory.dmp	shurk_stealer
behavioral1/memory/2332-19-0x0000000000400000-0x0000000000C5F000-memory.dmp	shurk_stealer
behavioral1/memory/2332-34-0x0000000000400000-0x0000000000C5F000-memory.dmp	shurk_stealer

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

pid process

2332 df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
discovery

System Language Discovery
T1614.001

Processes:

df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

pid process

2332 df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe
2332 df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

pid	process
2332	df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

pid	process
2332	df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe
2332	df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\df8d2bf603a5597433e8cfd62dbe7593_JaffaCakes118.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

1

T1555

Credentials from Web Browsers

1

T1555.003

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2332-0-0x000000000047A000-0x0000000000755000-memory.dmp

Filesize
2.9MB

Download
memory/2332-11-0x0000000000400000-0x0000000000C5F000-memory.dmp

Filesize
8.4MB

Download
memory/2332-15-0x0000000000400000-0x0000000000C5F000-memory.dmp

Filesize
8.4MB

Download
memory/2332-18-0x0000000000400000-0x0000000000C5F000-memory.dmp

Filesize
8.4MB

Download
memory/2332-19-0x0000000000400000-0x0000000000C5F000-memory.dmp

Filesize
8.4MB

Download
memory/2332-10-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2332-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2332-6-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2332-5-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2332-3-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2332-1-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/2332-33-0x000000000047A000-0x0000000000755000-memory.dmp

Filesize
2.9MB

Download
memory/2332-34-0x0000000000400000-0x0000000000C5F000-memory.dmp

Filesize
8.4MB

Download

Analysis

Sharing